Decent - JanuaryPersimmon2024's results

Lines of code

https://github.com/decentxyz/decent-bridge/blob/7f90fd4489551b69c20d11eeecb17a3f564afb18/src/DcntEth.sol#L20

Vulnerability details

Impact

The setRouter function is missing the onlyOwner access control modifier, and a malicious router can be assigned as the main router in the DcntEth contract.

Functions like:

function mint(address _to, uint256 _amount) public onlyRouter {
  _mint(_to, _amount);
}

function burn(address _from, uint256 _amount) public onlyRouter {
  _burn(_from, _amount);
}

Proof of Concept

function setRouter(address _router) public {
  router = _router;
}

Tools Used

Manual code review.

Recommended Mitigation Steps

Append the onlyOwner modifier to the setRouter function.

Assessed type

Access Control